Granted Patent B2

US 12,445,269 · App. 17/966,968 · Granted Oct 14, 2025

Inventors: HongQian Karen Lu (Austin, TX); Feng Shahab Pan (San Ramon, CA); Kyoungbong Koo (Fremont, CA); Pablo Blasco Herrero (Alicante, ES)

Assignee: THALES DIS CPL USA, INC.

H04L9/0819H04L9/0866H04L9/3249

Abstract

Claims (91)

1. A method for protecting an application resource file when a client device uses an application on a host device, comprising the steps by the host or the application on the host of:

binding the application resource file to the host device during an installation and subsequent execution of the application on the host device by:

creating, during said installation, an asymmetric key pair including a private key and a public key;

obtaining a device fingerprint of the host device;

signing together both the application resource file and the device fingerprint of the host device using the private key to provide a signature;

saving the signature and the public key; and

deleting, during said installation, both the private key and the device fingerprint, thereby completing said installation,

wherein the method further binds the host device by including the steps at the application provider of:

creating by the application provider a key pair for digital signature;

providing a public key of the application provider with the application; and

including or defining the device fingerprint of the client device or host device or both within the application, wherein the client device provided the host device finger print to the application provider via user interface or via an application programming interface,

wherein the method, after completing said installation, further comprises the steps during said execution of the application on the host device of:

obtaining the device fingerprint of the host device;

verifying the signature by using the application resource file, the device fingerprint of the host device, and the public key; and

using the application resource file if the verification succeeded,

wherein the application resource file is accessible only if a verification of the signature is successful.

2. The method of claim 1 , wherein the step of verifying the signature (S) of the application resource file (RF) and the host fingerprint (F1) by:

decrypting the signature (S) using an application's public key resulting in a first hash (H1) of the application resource file and host fingerprint;

obtaining the host fingerprint (F2) from the host;

computing a second hash (H2) of the application resource file and the host fingerprint (F2) obtained from the host;

perform an exclusive OR function among the application resource file, the first hash, and the second hash to provide a result K; and

when the first hash equates to the second hash, then the result K equals the application resource file and the application runs correctly.

3. The method of claim 2 , when the first hash does not equate to the second hash, then the result K does not equal the application resource file and the application provides a wrong result or does not work.

4. The method of claim 1 , wherein the method protects the application resource file from unauthorized usage.

5. A method for protecting an application resource file when a client device uses an application on a host device, comprising the steps by the application on the host device of:

binding the application resource file to the host device during an installation and subsequent execution of the application on the host device by:

during said installation,

creating an asymmetric key pair including a private key and a public key;

obtaining a device fingerprint of the host device;

signing together both the application resource file and the device fingerprint of the host device using the private key to provide a signature;

saving the signature and the public key; and

deleting, during said installation, both the private key and the device fingerprint, thereby completing said installation,

and during said execution,

obtaining the device fingerprint of the host device;

verifying the signature by using the application resource file, the device fingerprint of the host device, and the public key, wherein the signature was created during

said installation of the application at the host device by signing the application resource file and the device fingerprint of the host device using the private key corresponding to the public key creating during said installation of the application, and

using the application resource file if a verification of the signature is successful,

wherein the method further binds the host device by including the steps at the application provider of:

creating by the application provider a key pair for digital signature;

providing a public key of the application provider with the application; and

including or defining the device fingerprint of the client device or host device or both within the application, wherein the client device provided the host device finger print to the application provider via user interface or via an application programming interface.

6. The method of claim 5 , wherein the step of verifying the signature (S) of the application resource file (RF) and the host fingerprint (F1) by:

decrypting the signature (S) using a public key resulting in a first hash (H1) of the application resource file and host fingerprint;

obtaining the host fingerprint (F2) from the host;

computing a second hash (H2) of the application resource file and the host fingerprint obtained from the host;

perform an exclusive OR function among the application resource file, the first hash, and the second hash to provide a result K;

when the first hash equates to the second hash, then the result K equals the application resource file and the application runs correctly.

7. The method of claim 5 , wherein the method further comprises the step at the application provider of:

generating the application resource file;

creating a digital signature of the application resource file and the host device fingerprint using the application provider's private key; and

attaching the digital signature with the application resource file.

8. The method of claim 5 , wherein the method further comprises the steps at the client device of:

requesting a fingerprint from a host device;

receiving the fingerprint from the host device;

signing the resource file and fingerprint to form a signature;

sending the application, the resource file, a fingerprint configuration file, the signature, and a customer certificate to the host before executing the application on the host.

9. The method of claim 8 , wherein the method further comprises at the client device for each host device of:

obtaining a device fingerprint specified in the fingerprint configuration file;

creating a digital signature of the application resource file and the device fingerprint;

pushing the application, the application resource file, the fingerprint configuration file, the client certificate, and the digital signature to the host;

and further comprising steps at each host device of

verifying the customer certificate using the public key of the application provider;

verifying the fingerprint configuration file using a public key of the application provider;

verifying the signature of the application resource file and device fingerprint using a public key of the client; and

using the application resource file if the verification succeeds.

10. A system for protecting an application resource file when a client device uses an application on a host device, comprising:

one or more processors;

a memory coupled to the one or more processors, the memory containing computer instructions which when executed causes the one or more processors on the host device or the application to perform the steps of:

binding the application resource file to the host device during installation of the application on the host device by:

creating an asymmetric key pair including a private key and a public key;

obtaining a device fingerprint of the host device;

saving a signature and the public key; and

deleting the private key, and the device fingerprint,

wherein the one or more processors are further configured to perform the steps during execution of the application on the host device of:

obtaining the device fingerprint of the host device;

verifying the signature by using the application resource file, the device fingerprint of the host device, and the public key; and

using the application resource file if the verification succeeded,

wherein the application resource file is accessible only if a verification of the signature is successful,

wherein an application provider binds the host device by:

creating by the application provider a key pair for digital signature;

providing a public key of the application provider with the application; and

including or defining the device fingerprint of the client device or host device or both within the application, wherein the client device provided the host device finger print to the application provider via user interface or via an application programming interface.

11. The system of claim 10 , wherein the signature is created by signing the application resource file and the device fingerprint of the host device using the private key to provide a signature.

12. The system of claim 10 , wherein the step of verifying the signature (S) of the application resource file (RF) and the host fingerprint (F1) comprises:

decrypting the signature (S) using an application's public key resulting in a first hash (H1) of the application resource file and host fingerprint;

obtaining the host fingerprint (F2) from the host;

computing a second hash (H2) of the application resource file and the host fingerprint (F2) obtained from the host;

perform an exclusive OR function among the application resource file, the first hash, and the second hash to provide a result K;

when the first hash equates to the second hash, then the result K equals the application resource file and the application runs correctly.

13. The system of claim 10 , wherein the client device downloads the application resource file and wherein during a key rotation process, the application signs the application resource file and the device fingerprint of the host device.

14. The system of claim 10 , wherein the device fingerprint of the host device includes unique information about the host device including network connections and environmental settings.

Assignments (2)

Continuity (1)

References Cited (53)